spree_core 5.4.3 → 5.5.0.rc2

data/lib/spree/core/preferences/masking.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Spree
+  module Preferences
+    # Masks `:password`-typed preferences so secrets (API keys, OAuth
+    # tokens, signing secrets, …) never leave the server in plaintext.
+    #
+    # The mask token is a bullet sequence followed by the last 4
+    # characters of the original value — Stripe's "stored, here's the
+    # last 4" pattern.
+    module Masking
+      TOKEN = '••••'
+
+      # @param value [Object] the preference value to mask
+      # @return [String, nil] masked string, or nil if value is blank
+      def self.mask(value)
+        return nil if value.blank?
+
+        "#{TOKEN}#{value.to_s.last(4)}"
+      end
+
+      # @param value [Object] a value previously returned by `mask`
+      # @return [Boolean] true if value carries the mask token
+      def self.masked?(value)
+        value.is_a?(String) && value.start_with?(TOKEN)
+      end
+
+      # Serializes a Preferable's `preferences` hash for the wire,
+      # masking `:password` values. Keys are stringified to match the
+      # wire shape expected by JSON clients — schema entries built by
+      # `compute_preference_schema` cache `:key_string` to avoid a
+      # `to_s` allocation per field per request.
+      #
+      # @param preferable [#preferences, #preference_schema, nil] any object
+      #   that includes `Spree::Preferences::Preferable` and `Spree::PreferenceSchema`
+      # @return [Hash{String => Object}]
+      def self.serialize(preferable)
+        return {} if preferable.nil?
+
+        preferable.preference_schema.each_with_object({}) do |field, hash|
+          value = preferable.preferences[field[:key]]
+          hash[field[:key_string] || field[:key].to_s] = field[:type] == :password ? mask(value) : value
+        end
+      end
+    end
+  end
+end

data/lib/spree/core/preferences/preferable_class_methods.rb

@@ -18,7 +18,13 @@ module Spree::Preferences
       end
 
       define_method preference_setter_method(name) do |value|
-        value = parse_on_set.call(value) if parse_on_set.is_a?(Proc)
+        if parse_on_set.is_a?(Proc)
+          # Procs that accept more than one arg opt into receiving the
+          # owning record so they can scope (e.g. `normalize_id_preference`
+          # rejecting cross-store IDs). `arity.abs > 1` covers both the
+          # `(value, owner)` and `(value, owner = nil)` shapes.
+          value = parse_on_set.arity.abs > 1 ? parse_on_set.call(value, self) : parse_on_set.call(value)
+        end
         value = convert_preference_value(value, type, nullable: nullable)
         preferences[name] = value
 

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.4.3'.freeze
+  VERSION = '5.5.0.rc2'.freeze
 
   def self.version
     VERSION

data/lib/spree/core.rb

@@ -112,7 +112,8 @@ module Spree
       webhooks: :default,
       payment_webhooks: :default,
       api_keys: :default,
-      search: :default
+      search: :default,
+      stock_reservations: :default
     )
   end
 
@@ -241,6 +242,14 @@ module Spree
     Rails.application.config.spree.stock_splitters = value
   end
 
+  def self.order_routing
+    Rails.application.config.spree.order_routing
+  end
+
+  def self.order_routing=(value)
+    Rails.application.config.spree.order_routing = value
+  end
+
   def self.promotions
     Rails.application.config.spree.promotions
   end
@@ -289,6 +298,21 @@ module Spree
     Rails.application.config.spree.taxon_rules = value
   end
 
+  # Class-name strings (`'Spree::Product'`, `'Spree::Order'`,
+  # `Spree.user_class.to_s`, plus any registered by apps) for resources that
+  # expose tags via `acts_as_taggable_on :tags`. Used by the Admin API
+  # `/tags` autocomplete endpoint to validate `taggable_type`. Apps extend
+  # the list in an initializer:
+  #
+  #   Spree.taggable_types << 'MyApp::Vendor'
+  def self.taggable_types
+    Rails.application.config.spree.taggable_types
+  end
+
+  def self.taggable_types=(value)
+    Rails.application.config.spree.taggable_types = value
+  end
+
   def self.reports
     Rails.application.config.spree.reports
   end
@@ -338,6 +362,36 @@ module Spree
     Rails.application.config.spree.pricing = value
   end
 
+  # Registry of authentication strategy classes for the Store API.
+  # @return [Spree::Authentication::StrategyRegistry]
+  # @example Registering a third-party identity provider
+  #   Spree.store_authentication_strategies.add(:auth0, MyApp::Auth::Auth0Strategy)
+  # @example Removing a strategy
+  #   Spree.store_authentication_strategies.remove(:email)
+  def self.store_authentication_strategies
+    Rails.application.config.spree.store_authentication_strategies
+  end
+
+  # @param value [Spree::Authentication::StrategyRegistry] the registry to use for Store API authentication dispatch
+  # @return [Spree::Authentication::StrategyRegistry] the assigned registry
+  def self.store_authentication_strategies=(value)
+    Rails.application.config.spree.store_authentication_strategies = value
+  end
+
+  # Registry of authentication strategy classes for the Admin API.
+  # @return [Spree::Authentication::StrategyRegistry]
+  # @example Registering an SSO strategy for admin users
+  #   Spree.admin_authentication_strategies.add(:okta, MyApp::Auth::OktaStrategy)
+  def self.admin_authentication_strategies
+    Rails.application.config.spree.admin_authentication_strategies
+  end
+
+  # @param value [Spree::Authentication::StrategyRegistry] the registry to use for Admin API authentication dispatch
+  # @return [Spree::Authentication::StrategyRegistry] the assigned registry
+  def self.admin_authentication_strategies=(value)
+    Rails.application.config.spree.admin_authentication_strategies = value
+  end
+
   def self.analytics
     @analytics ||= AnalyticsConfig.new
   end
@@ -425,8 +479,6 @@ module Spree
   end
 
   module Core
-    autoload :TokenGenerator, 'spree/core/token_generator'
-
     class GatewayError < RuntimeError; end
     class DestroyWithOrdersError < StandardError; end
   end
@@ -444,14 +496,12 @@ require 'spree/localized_number'
 require 'spree/money'
 require 'spree/permitted_attributes'
 require 'spree/service_module'
-require 'spree/database_type_utilities'
 require 'spree/analytics'
 require 'spree/events'
 require 'spree/webhooks'
 
 require 'spree/core/partials'
 require 'spree/core/controller_helpers/auth'
-require 'spree/core/controller_helpers/common'
 require 'spree/core/controller_helpers/order'
 require 'spree/core/controller_helpers/store'
 require 'spree/core/controller_helpers/strong_parameters'
@@ -462,6 +512,7 @@ require 'spree/core/controller_helpers/turbo'
 require 'spree/core/preferences/store'
 require 'spree/core/preferences/scoped_store'
 require 'spree/core/preferences/runtime_configuration'
+require 'spree/core/preferences/masking'
 
 require 'spree/core/permission_configuration'
 require 'spree/core/ransack_configuration'

data/lib/spree/permitted_attributes.rb

@@ -56,6 +56,7 @@ module Spree
       :shipment_attributes,
       :shipping_method_attributes,
       :shipping_category_attributes,
+      :channel_attributes,
       :source_attributes,
       :stock_item_attributes,
       :stock_location_attributes,
@@ -90,10 +91,9 @@ module Spree
 
     @@allowed_origin_attributes = [:origin]
 
-    @@api_key_attributes = [:name, :key_type]
+    @@api_key_attributes = [:name, :key_type, { scopes: [] }]
 
-    @@asset_attributes = [:type, :viewable_id, :viewable_type, :attachment, :alt, :position,
-                          :media_type, :focal_point_x, :focal_point_y, :external_video_url]
+    @@asset_attributes = [:type, :viewable_id, :viewable_type, :attachment, :alt, :position, :url, :signed_id]
 
     @@checkout_attributes = [
       :coupon_code, :email, :shipping_method_id, :special_instructions, :use_billing, :use_shipping,
@@ -169,7 +169,7 @@ module Spree
 
     @@payment_attributes = [:amount, :payment_method_id, :payment_method]
 
-    @@payment_method_attributes = [:name, :type, :description, :active, :display_on, :auto_capture, :position]
+    @@payment_method_attributes = [:name, :type, :description, :active, :display_on, :auto_capture, :position, { metadata: {}, preferences: {} }]
 
     @@payment_session_attributes = [:amount, :payment_method_id, { external_data: {} }]
 
@@ -192,8 +192,8 @@ module Spree
         label_list: [],
         option_type_ids: [],
         taxon_ids: [],
-        store_ids: [],
-        product_option_types_attributes: [:id, :option_type_id, :position, :_destroy]
+        product_option_types_attributes: [:id, :option_type_id, :position, :_destroy],
+        legacy_product_publications_attributes: [:id, :channel_id, :published_at, :unpublished_at, :_destroy]
       }
     ]
 
@@ -240,6 +240,8 @@ module Spree
 
     @@shipping_category_attributes = [:name]
 
+    @@channel_attributes = [:name, :code, :active, :default, :preferred_order_routing_strategy]
+
     @@shipping_method_attributes = [:name, :admin_name, :code, :tracking_url, :tax_category_id, :display_on,
                                     :estimated_transit_business_days_min, :estimated_transit_business_days_max,
                                     :calculator_type, :preferences, zone_ids: [], shipping_category_ids: [], calculator_attributes: {}]
@@ -251,7 +253,7 @@ module Spree
       :gateway_payment_profile_id, :last_digits, :name, :encrypted_data
     ]
 
-    @@stock_item_attributes = [:variant_id, :stock_location_id, :backorderable, :count_on_hand]
+    @@stock_item_attributes = [:variant_id, :stock_location_id, :backorderable, :count_on_hand, { metadata: {} }]
 
     @@stock_location_attributes = [
       :name, :active, :address1, :address2, :city, :zipcode, :company,

data/lib/spree/testing_support/factories/address_factory.rb

@@ -5,19 +5,26 @@ FactoryBot.define do
     company           { 'Company' }
     sequence(:address1) { |n| "#{n} Lovely Street" }
     address2          { 'Northwest' }
-    city              { 'Herndon' }
-    zipcode           { '35005' }
+    city              { 'New York' }
+    zipcode           { '10118' }
     phone             { '555-555-0199' }
     alternative_phone { '555-555-0199' }
 
-    state { |address| address.association(:state) || Spree::State.last }
-
-    country do |address|
-      if address.state
-        address.state.country
-      else
-        address.association(:country)
+    # Default to a real US/NY pair (cached via find_or_create_by) so generated
+    # OpenAPI examples carry plausible country/state fields. Tests that need a
+    # different state/country pass them explicitly.
+    country do
+      Spree::Country.find_or_create_by!(iso: 'US') do |c|
+        c.iso3 = 'USA'
+        c.name = 'United States of America'
+        c.iso_name = 'UNITED STATES'
+        c.numcode = 840
+        c.states_required = true
       end
     end
+
+    state do |address|
+      (address.country || Spree::Country.find_by(iso: 'US'))&.states&.find_or_create_by!(abbr: 'NY') { |s| s.name = 'New York' }
+    end
   end
 end

data/lib/spree/testing_support/factories/api_key_factory.rb

@@ -10,6 +10,7 @@ FactoryBot.define do
 
     trait :secret do
       key_type { 'secret' }
+      scopes { ['write_all'] }
     end
 
     trait :revoked do

data/lib/spree/testing_support/factories/channel_factory.rb

@@ -0,0 +1,8 @@
+FactoryBot.define do
+  factory :channel, class: Spree::Channel do
+    store { Spree::Store.default || association(:store) }
+    sequence(:name) { |n| "Channel #{n}" }
+    sequence(:code) { |n| "channel_#{n}" }
+    active { true }
+  end
+end

data/lib/spree/testing_support/factories/line_item_factory.rb

@@ -8,14 +8,8 @@ FactoryBot.define do
       product { nil }
     end
     variant do
-      resolved_product = product || begin
-        if order&.store&.present?
-          create(:product, stores: [order.store])
-        else
-          create(:product)
-        end
-      end
-      resolved_product.master
+      resolved_product = product || create(:product)
+      resolved_product.default_variant
     end
   end
 end

data/lib/spree/testing_support/factories/newsletter_subscriber_factory.rb

@@ -3,6 +3,8 @@ FactoryBot.define do
     email { FFaker::Internet.unique.email }
     verified_at { nil }
 
+    store { Spree::Current.store || create(:store) }
+
     trait :with_user do
       association :user, factory: :user
     end

data/lib/spree/testing_support/factories/product_factory.rb

@@ -4,12 +4,10 @@ FactoryBot.define do
     description       { generate(:random_description) }
     cost_price        { 17.00 }
     sku               { generate(:sku) }
-    available_on      { 1.year.ago }
-    make_active_at    { 1.year.ago }
     deleted_at        { nil }
     shipping_category { |r| Spree::ShippingCategory.first || r.association(:shipping_category) }
     status            { 'active' }
-    stores            { [Spree::Store.default] }
+    store             { Spree::Store.default || association(:store) }
 
     transient do
       price { 19.99 }
@@ -17,11 +15,8 @@ FactoryBot.define do
       currency { nil }
     end
 
-    # ensure stock item will be created for this products master
-    # also attach this product to the default store if no stores are passed in
     before(:create) do |_product|
       create(:stock_location) unless Spree::StockLocation.any?
-      create(:store, default: true) unless Spree::Store.any?
     end
     after(:create) do |product, evaluator|
       existing_location_ids = product.master.stock_items.pluck(:stock_location_id)
@@ -30,9 +25,23 @@ FactoryBot.define do
       end
 
       if evaluator.price.present?
-        price_currency = evaluator.currency || product.stores.first&.default_currency || 'USD'
+        price_currency = evaluator.currency || product.store&.default_currency || 'USD'
         product.master.set_price(price_currency, evaluator.price, evaluator.compare_at_price)
       end
+
+      # Test convenience only: auto-publish each product on its store's
+      # default channel so legacy spec assertions that depend on
+      # current-channel visibility (.active, .available, .not_discontinued)
+      # keep passing. Production callers must publish explicitly via the
+      # Admin SDK / Dashboard create form.
+      if product.store&.default_channel && product.product_publications.empty?
+        Spree::ProductPublication.create!(
+          product: product,
+          channel: product.store.default_channel,
+          published_at: product.available_on,
+          unpublished_at: product.discontinue_on
+        )
+      end
     end
 
     factory :custom_product do

data/lib/spree/testing_support/factories/product_publication_factory.rb

@@ -0,0 +1,6 @@
+FactoryBot.define do
+  factory :product_publication, class: Spree::ProductPublication do
+    product
+    channel { product&.store&.default_channel || association(:channel) }
+  end
+end

data/lib/spree/testing_support/factories/refresh_token_factory.rb

@@ -0,0 +1,15 @@
+FactoryBot.define do
+  factory :refresh_token, class: 'Spree::RefreshToken' do
+    association :user, factory: :user
+    user_type { user.class.to_s }
+    expires_at { Spree::RefreshToken.default_expiry.from_now }
+
+    trait :for_admin do
+      association :user, factory: :admin_user
+    end
+
+    trait :expired do
+      expires_at { 1.minute.ago }
+    end
+  end
+end

data/lib/spree/testing_support/factories/stock_location_factory.rb

@@ -19,8 +19,8 @@ FactoryBot.define do
         # variant will add itself to all stock_locations in an after_create
         # creating a product will automatically create a master variant
         store = Spree::Store.first || create(:store)
-        product_1 = create(:product, stores: [store])
-        product_2 = create(:product, stores: [store])
+        product_1 = create(:product)
+        product_2 = create(:product)
 
         stock_location.stock_item_or_create(product_1.master).adjust_count_on_hand(10)
         stock_location.stock_item_or_create(product_2.master).adjust_count_on_hand(20)

data/lib/spree/testing_support/factories/stock_reservation_factory.rb

@@ -0,0 +1,31 @@
+FactoryBot.define do
+  factory :stock_reservation, class: Spree::StockReservation do
+    quantity { 1 }
+    expires_at { 10.minutes.from_now }
+
+    transient do
+      order { nil }
+    end
+
+    # Build the order first (with at least one line_item), then derive
+    # stock_item from that line_item's variant so the three FKs reference the
+    # same variant. Callers can override stock_item:/line_item:/order: to wire
+    # up a specific scenario.
+    after(:build) do |reservation, evaluator|
+      reservation.order ||= evaluator.order || create(:order_with_line_items, line_items_count: 1)
+
+      if reservation.line_item.nil?
+        reservation.line_item = reservation.order.line_items.first ||
+                                create(:line_item, order: reservation.order)
+        reservation.order.line_items.reload
+      end
+
+      reservation.stock_item ||= reservation.line_item.variant.stock_items.first ||
+                                 create(:stock_item, variant: reservation.line_item.variant)
+    end
+
+    trait :expired do
+      expires_at { 1.minute.ago }
+    end
+  end
+end

data/lib/spree/testing_support/factories/variant_factory.rb

@@ -11,7 +11,7 @@ FactoryBot.define do
     is_master       { 0 }
     track_inventory { true }
 
-    product       { |p| p.association(:base_product, stores: [Spree::Store.default]) }
+    product       { |p| p.association(:base_product) }
     option_values { [build(:option_value)] }
 
     transient do
@@ -35,14 +35,14 @@ FactoryBot.define do
       end
 
       if evaluator.price.present?
-        price_currency = evaluator.currency || variant.product&.stores&.first&.default_currency || 'USD'
+        price_currency = evaluator.currency || variant.product&.store&.default_currency || 'USD'
         variant.set_price(price_currency, evaluator.price, evaluator.compare_at_price)
       end
     end
 
     factory :variant do
       # on_hand 5
-      product { |p| p.association(:product, stores: [Spree::Store.default]) }
+      product { |p| p.association(:product) }
 
       factory :with_image_variant do
         images { create_list(:image, 1) }

data/lib/spree/testing_support/order_walkthrough.rb

@@ -4,7 +4,7 @@ class OrderWalkthrough
 
     # A payment method must exist for an order to proceed through the Address state
     unless Spree::PaymentMethod.exists?
-      FactoryBot.create(:check_payment_method, stores: [store])
+      FactoryBot.create(:check_payment_method)
     end
 
     # Need to create a valid zone too...

data/lib/spree/testing_support/store.rb

@@ -31,6 +31,16 @@ RSpec.configure do |config|
       @default_store&.promotions = []
       @default_store&.update_column(:checkout_zone_id, nil) if @default_store&.read_attribute(:checkout_zone_id).present?
       @default_store&.payment_methods = []
+      # The shared +@default_store+ Ruby object lives across the whole
+      # +before(:all)+ block, so AR association caches (+default_market+,
+      # +channels+, etc.) and per-instance memos (+@has_markets+) need to
+      # be cleared between examples or stale +nil+s leak across tests.
+      if @default_store
+        @default_store.association(:default_market).reset if @default_store.association_cached?(:default_market)
+        @default_store.association(:markets).reset if @default_store.association_cached?(:markets)
+        @default_store.remove_instance_variable(:@has_markets) if @default_store.instance_variable_defined?(:@has_markets)
+        @default_store.reload
+      end
     end
   end
 

data/lib/spree/upgrades/5_4_to_5_5/manifest.yml

@@ -0,0 +1,53 @@
+# Spree 5.4 → 5.5 upgrade manifest.
+#
+# Lists ONLY the version-specific rake tasks that perform data backfills.
+# Universal upgrade steps (bundle update, db:migrate, scheduling cron jobs,
+# reviewing breaking changes) are NOT in this file:
+#
+#   - `bundle update` + `db:migrate` are handled by your deploy pipeline
+#     (Heroku release phase, K8s init container, Render auto-migrate,
+#     Capistrano deploy hook, etc.) and by the @spree/cli's `spree upgrade`
+#     wrapper for local development.
+#   - Cron scheduling, optional tunings, and human-readable behavior changes
+#     live in the upgrade doc at docs/developer/upgrades/5.4-to-5.5.mdx.
+#
+# This manifest is the machine-runnable shape — what `bin/rake spree:upgrade`
+# (in production) and `spree upgrade` (in dev) execute. Every step must be a
+# rake task and must be idempotent. Re-running the full manifest is safe.
+---
+from: "5.4"
+to: "5.5"
+docs: "https://spreecommerce.org/docs/developer/upgrades/5.4-to-5.5"
+
+steps:
+  - id: media
+    name: "Migrate legacy variant-pinned images to product-level media"
+    task: "spree:media:migrate_master_images_to_product_media"
+    notes: |
+      Enqueues one `Spree::Media::MigrateProductAssetsJob` per product onto
+      the `images` queue — confirm your job runner is processing that queue.
+      Storefront keeps working while jobs drain (old assets stay variant-pinned
+      until each job finishes). For large catalogs, tune with BATCH_SIZE=1000.
+
+  - id: channels
+    name: "Run the Channels upgrade (creates default channels, publications, order channel ids)"
+    task: "spree:channels:upgrade"
+    notes: |
+      Aggregator that runs four sub-tasks in order:
+        1. spree:channels:create_defaults
+        2. spree:upgrade:populate_publications
+        3. spree:channels:backfill_order_channel_ids
+        4. spree:channels:backfill_product_publication_dates
+      Until this runs, every product has store_id IS NULL and is invisible
+      to Product.for_store — admin lists, storefront catalog, and search
+      indexer all return empty.
+
+  - id: reindex
+    name: "Reindex products against the configured search provider"
+    task: "spree:search:reindex"
+    notes: |
+      No-op for the default Database provider. For Meilisearch (or any other
+      external search provider), this is required after the channels upgrade
+      because products only become visible to Product.for_store once they
+      have a store_id — reindexing before the channels step would index 0
+      products. Must run AFTER `channels`.

data/lib/tasks/channels.rake

@@ -0,0 +1,94 @@
+namespace :spree do
+  namespace :channels do
+    desc 'Create the default channel for every existing store (idempotent — calls Store#ensure_default_channel).'
+    task create_defaults: :environment do
+      created = 0
+      Spree::Store.find_each do |store|
+        next if store.default_channel
+
+        store.ensure_default_channel
+        created += 1
+        puts "  Created default channel for store '#{store.name}'"
+      end
+
+      puts created.zero? ? '  All stores already have a default channel.' : "  Created #{created} default channel(s)."
+    end
+
+    desc 'Backfill spree_orders.channel_id from the legacy spree_orders.channel string column'
+    task backfill_order_channel_ids: :environment do
+      # Idempotent: only touches orders where channel_id is nil. Safe to
+      # re-run after partial completion. Returns gracefully if the legacy
+      # string column has already been dropped.
+      unless legacy_channel_column?
+        puts 'Legacy channel column not present — backfill is unnecessary.'
+        next
+      end
+
+      Spree::Store.find_each do |store|
+        legacy_codes = Spree::Order.where(store_id: store.id, channel_id: nil)
+                                   .distinct
+                                   .pluck(Arel.sql('channel'))
+                                   .compact_blank
+
+        codes_to_process = legacy_codes.uniq
+        codes_to_process << Spree::Channel::DEFAULT_CODE unless codes_to_process.include?(Spree::Channel::DEFAULT_CODE)
+
+        codes_to_process.each do |code|
+          channel = store.channels.find_or_create_by!(code: code) do |c|
+            c.name = code.titleize
+          end
+
+          scope = Spree::Order.where(store_id: store.id, channel_id: nil)
+          scope = if code == Spree::Channel::DEFAULT_CODE
+                    # Only the default channel claims NULL/blank rows.
+                    scope.where(Arel.sql("channel = ? OR channel IS NULL OR channel = ''"), code)
+                  else
+                    scope.where(Arel.sql('channel = ?'), code)
+                  end
+
+          updated = scope.update_all(channel_id: channel.id)
+
+          next if updated.zero?
+
+          puts "  Store '#{store.name}': mapped #{updated} orders with channel='#{code}' → #{channel.name} (#{channel.code})"
+        end
+      end
+    end
+
+    desc 'Backfill published_at and unpublished_at on ProductPublications from the legacy Product.available_on / discontinue_on columns'
+    task backfill_product_publication_dates: :environment do
+      # Per-product loop (not join-update) for SQLite/MySQL/Postgres portability.
+      published = 0
+      unpublished = 0
+
+      products_with_dates = Spree::Product.where.not(available_on: nil).or(Spree::Product.where.not(discontinue_on: nil))
+
+      products_with_dates.find_each(batch_size: 500) do |product|
+        publications = Spree::ProductPublication.where(product_id: product.id)
+        # Read raw columns — +product.available_on+ / +product.discontinue_on+
+        # go through +Product::Channels+'s reader override which prefers the
+        # current-channel publication's date (which is nil pre-backfill).
+        legacy_available_on   = product[:available_on]
+        legacy_discontinue_on = product[:discontinue_on]
+
+        published   += publications.where(published_at: nil).update_all(published_at: legacy_available_on) if legacy_available_on
+        unpublished += publications.where(unpublished_at: nil).update_all(unpublished_at: legacy_discontinue_on) if legacy_discontinue_on
+      end
+
+      total = published + unpublished
+      puts total.zero? ? '  All product-publication dates already populated.' : "  Backfilled dates on #{published} published_at + #{unpublished} unpublished_at column(s)."
+    end
+
+    desc 'Run the full 5.4 → 5.5 channel upgrade: create default channels, backfill products to store_id and publications, backfill order channels, backfill publication date windows'
+    task upgrade: [
+      :create_defaults,
+      'spree:upgrade:populate_publications',
+      :backfill_order_channel_ids,
+      :backfill_product_publication_dates
+    ]
+
+    def legacy_channel_column?
+      ActiveRecord::Base.connection.column_exists?(:spree_orders, :channel)
+    end
+  end
+end

data/lib/tasks/cli.rake

@@ -12,8 +12,9 @@ namespace :spree do
     task create_api_key: :environment do
       name = ENV.fetch('NAME')
       key_type = ENV.fetch('KEY_TYPE')
+      scopes = ENV.fetch('SCOPES', '').split(',').map(&:strip).reject(&:empty?)
       store = Spree::Store.default
-      key = store.api_keys.create!(name: name, key_type: key_type)
+      key = store.api_keys.create!(name: name, key_type: key_type, scopes: scopes)
       print key.plaintext_token
     end